Ok, there's a private PR over on osquery-codesign, is it mergeable? It depended on 7059 but I just merged that